open source test tools for uefi · cansecwest 2009 bios protection common.bios_wp blackhat usa 2009...
TRANSCRIPT
![Page 1: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/1.jpg)
presented by
UEFI Plugfest – May 2014
Open Source Test
Tools for UEFI
Ricardo Neri, Software Engineer
Vincent Zimmer, Sr. Principal Engineer
![Page 2: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/2.jpg)
Agenda
Linux UEFI Validation Operating
System
CHIPSEC - Platform Security
Assessment Framework
What Now?
www.uefi.org 2The UEFI Forum
![Page 3: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/3.jpg)
Linux UEFI Validation Operating System
Objective: Create a Linux-readiness validation operating system
which helps firmware engineers and Linux contributors reduce
development and enabling time for Linux on an UEFI system.
www.uefi.org 3The UEFI Forum
Co
llab
ora
tio
n
Consolidates existing UEFI
test suites
Qu
alit
y Early
Detection of Firmware Problems
Sco
pe
Expand Firmware Test
Coverage
Co
mm
un
ity
Open and Free
Contributions are welcome!
Better UEFI Firmware
![Page 4: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/4.jpg)
What is it not?
A proprietary Intel tool
www.uefi.org 4The UEFI Forum
A new test suite
A certification tool for Linux or UEFI
compliance
A replacement for existing test suites
![Page 5: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/5.jpg)
The Details
www.uefi.org 5The UEFI Forum
*Fu
ture
sco
pe
Linux UEFI validation operating system
Firmware
Bootloader
Kernel
Userspace
Test Manager
Test suite 1
Test suite 2
Test suite n
… Test suite n-1
![Page 6: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/6.jpg)
Covers Entire Execution Cycle
www.uefi.org 6The UEFI Forum
Boot-time Firmware Services
Bootloader
Kernel
Userspace
Runtime Firmware Services
Soft
ware
sta
ck
Execution time
Test gap
testTest gap testtest
![Page 7: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/7.jpg)
Future Development
Tests for bootloaders
Automation
UEFI Capsule tests
UEFI Network stack tests
UEFI Secure Boot tests
www.uefi.org 7The UEFI Forum
![Page 8: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/8.jpg)
CHIPSEC - Platform Security
Assessment Framework
A single test
designed to
run in multiple
environments
The UEFI Forum www.uefi.org 8
![Page 9: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/9.jpg)
How do we raise the bar?
Empowering End-Users to Make a Risk DecisionThe UEFI Forum www.uefi.org 9
![Page 10: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/10.jpg)
Known Threats and CHIPSEC modules
Issue CHIPSEC Module Public Details
SMRAM Locking common.smm CanSecWest 2006
BIOS Keyboard Buffer Sanitization common.bios_kbrd_buffer DEFCON 16 2008
SMRR Configuration common.smrr ITL 2009CanSecWest 2009
BIOS Protection common.bios_wp BlackHat USA 2009CanSecWest 2013
Black Hat 2013NoSuchCon 2013
Flashrom
SPI Controller Locking common.spi_lock FlashromCopernicus
BIOS Interface Locking common.bios_ts PoC 2007
Access Control for Secure Boot Keys common.secureboot.keys UEFI 2.4 Spec
Access Control for Secure Boot Variables common.secureboot.variables UEFI 2.4 Spec
The UEFI Forum www.uefi.org 10
![Page 11: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/11.jpg)
Example: BIOS Write ProtectionBlack Hat USA 2013 “BIOS Security” – MITRE (Kovah, Butterworth, Kallenberg)
NoSuchCon 2013 “BIOS Chronomancy: Fixing the Static Root of Trust for Measurement” – MITRE (Kovah, Butterworth, Kallenberg)
Is BIOS correctly protected?
common.bios_wp
[+] imported chipsec.modules.common.bios_wp[x][ =======================================================================[x][ Module: BIOS Region Write Protection[x][ =======================================================================BIOS Control (BDF 0:31:0 + 0xDC) = 0x2A[05] SMM_BWP = 1 (SMM BIOS Write Protection)[04] TSS = 0 (Top Swap Status)[01] BLE = 1 (BIOS Lock Enable)[00] BIOSWE = 0 (BIOS Write Enable)
[+] BIOS region write protection is enabled (writes restricted to SMM)
[*] BIOS Region: Base = 0x00500000, Limit = 0x00FFFFFFSPI Protected Ranges------------------------------------------------------------PRx (offset) | Value | Base | Limit | WP? | RP?------------------------------------------------------------PR0 (74) | 00000000 | 00000000 | 00000000 | 0 | 0 PR1 (78) | 8FFF0F40 | 00F40000 | 00FFF000 | 1 | 0 PR2 (7C) | 8EDF0EB1 | 00EB1000 | 00EDF000 | 1 | 0 PR3 (80) | 8EB00EB0 | 00EB0000 | 00EB0000 | 1 | 0 PR4 (84) | 8EAF0C00 | 00C00000 | 00EAF000 | 1 | 0
[!] SPI protected ranges write-protect parts of BIOS region (other parts of BIOS can be modified)
[+] PASSED: BIOS is write protected11
![Page 12: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/12.jpg)
Direct HW Access for Manual TestingExamples:
chipsec_util msr 0x200
chipsec_util mem 0x0 0x41E 0x20
chipsec_util pci enumerate
chipsec_util pci 0x0 0x1F 0x0 0xDC byte
chipsec_util io 0x61 byte
chipsec_util mmcfg 0 0x1F 0 0xDC 1 0x1
chipsec_util cmos dump
chipsec_util ucode id
chipsec_util smi 0x01 0xFF
chipsec_util idt 0
chipsec_util cpuid 1
chipsec_util spi read 0x700000 0x100000 bios.bin
chipsec_util decode spi.bin
chipsec_util uefi var-list
..
The UEFI Forum www.uefi.org 12
![Page 13: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/13.jpg)
ForensicsLive system firmware analysis
chipsec_util spi info
chipsec_util spi dump rom.bin
chipsec_util spi read 0x700000 0x100000 bios.bin
chipsec_util uefi var-list
chipsec_util uefi var-read db D719B2CB-3D3A-4596-A3BC-DAD00E67656F db.bin
Offline system firmware analysischipsec_util uefi keys PK.bin
chipsec_util uefi nvram vss bios.bin
chipsec_util uefi decode rom.bin
chipsec_util decode rom.bin
The UEFI Forum www.uefi.org 13
![Page 14: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/14.jpg)
Moving Forward
Test tools complement the SCT, but the community can do more!
Changing our development philosophy?
• “Testing shows the presence, not the absence of bugs” (Dijkstra,1970)
• Better Living Through Tools? (Zimmer, 2013)
Getting code coverage closer to 100%?
• Internal Intel effort using DDT with EDK II
• Moving to KLEE (open source)
“Infrastructure for automatic code checking” (coreboot)
• Automated system including KLEE, Splint, Frama-C
The UEFI Forum www.uefi.org 14
![Page 15: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/15.jpg)
What Now?
Linux UEFI Validation Operating System
Download the code…
https://github.com/01org/luv-yocto
Download test images …
https://01.org/linux-uefi-validation
Submit your contributions
Questions?– [email protected]
CHIPSEC
Get the tool
https://github.com/chipsec/chipsec
Submit your contributions
Questions?
www.uefi.org 15The UEFI Forum
![Page 16: Open Source Test Tools for UEFI · CanSecWest 2009 BIOS Protection common.bios_wp BlackHat USA 2009 CanSecWest 2013 Black Hat 2013 NoSuchCon 2013 Flashrom SPI Controller Locking common.spi_lock](https://reader035.vdocument.in/reader035/viewer/2022070711/5ecadad074f7a10bfb711913/html5/thumbnails/16.jpg)
For more information on the Unified EFI Forum and UEFI Specifications, visit http://www.uefi.org
presented by
www.uefi.org 16The UEFI Forum